Privacy Policy

AfriCore-OS PRIVACY POLICY Effective Date: 6 April 2009. Last Updated:3 October 2026 At afriCore-OS, your privacy and the security of your information are important to us. This Privacy Policy explains how afriCore-OS collects, uses, stores, protects, shares and otherwise processes personal information when you access or use our platform, applications, websites, dashboards and related services. afriCore-OS provides technology solutions for SACCOs, cooperatives, welfare groups and related organizations, including member management, savings, shares, loans, payments, transport, courier services, reporting and financial administration. By accessing or using afriCore-OS, you acknowledge that you have read and understood this Privacy Policy. 1. WHO WE ARE afriCore-OS is a technology platform designed to support SACCOs, cooperatives, welfare organizations and related institutions in managing their operations and member services. Depending on the service and relationship involved, afriCore-OS powered by

Memsap

may act as a **data processor

processing information on behalf of a SACCO, cooperative or other organization, while that organization may act as the **data controller** determining the purposes and means of processing. Where afriCore-OS determines the purposes and means of processing personal information directly, afriCore-OS may act as a data controller. The applicable responsibilities will depend on the particular service, contractual arrangement and processing activity. 2. INFORMATION WE COLLECT We collect and process information necessary to provide, secure and improve our services. 2.1 Personal Information This may include: - Full name - Date of birth where required - Email address - Telephone/mobile number - Postal or physical address - Identification or passport details - Membership number - Employment or organizational information - Next-of-kin or beneficiary information where applicable - Account credentials - Information required for identity verification 2.2 Financial and Transaction Information Depending on the services used, we may process: - Member savings - Shares - Loan applications and balances - Loan repayment history - Payment records - Contributions - Dividends - Fines and charges - Transaction history - Account balances - Statements - Financial reports - Other information required to administer SACCO or cooperative services 2.3 Device and Technical Information. When you use afriCore-OS, we may automatically collect certain technical information, including: - IP address - Browser type and version - Device type - Operating system - Login date and time - Authentication records - System activity - Access logs - Security events - Error and diagnostic information This information helps us maintain security, detect unauthorized access, troubleshoot technical problems and improve platform performance. 2.4 Information from Third Parties. Where authorized and necessary, information may be received from: - SACCOs and cooperative organizations - Banks - Payment service providers - Mobile-money or payment platforms - Identity-verification providers - Cloud-service providers - Other service providers integrated with afriCore-OS Third-party information is processed only for legitimate and authorized purposes. 3. HOW WE USE YOUR INFORMATION We process personal information for purposes including: - Creating and managing member accounts - Managing SACCO and cooperative membership - Managing savings and shares - Processing loans and repayments - Processing payments and transactions - Supporting transport and courier services where applicable - Providing dashboards and financial analytics - Generating reports - Supporting audits and regulatory reporting - Communicating account activity and service information - Providing customer support - Maintaining platform functionality - Detecting, preventing and investigating fraud - Protecting system and account security - Troubleshooting and improving our services - Meeting contractual obligations - Complying with applicable laws and regulatory requirements We do not sell personal information to third parties for their independent marketing purposes. --- # 4. LAWFUL BASIS FOR PROCESSING We process personal information only where there is a lawful basis to do so. Depending on the circumstances, this may include: - Performance of a contract or provision of requested services - Compliance with a legal or regulatory obligation - Consent provided by the data subject - Legitimate interests, where applicable and permitted by law - Protection of rights and prevention of fraud or abuse - Other lawful grounds recognized under applicable data-protection legislation Where processing is based on consent, you may withdraw that consent where legally permitted. Withdrawal of consent will not affect processing that was lawfully carried out before the withdrawal. 5. DATA PROTECTION PRINCIPLES afriCore-OS powered by

Memsap

seeks to process personal information in accordance with applicable data-protection principles, including that personal information should be processed lawfully, fairly and transparently; collected for specified legitimate purposes; limited to what is necessary; kept accurate; protected against unauthorized access; and retained only for as long as necessary. These principles are consistent with the requirements of Kenya's Data Protection Act, 2019. 6. DATA SECURITY We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, misuse or destruction. These measures may include: - Encryption of sensitive information in transit and, where appropriate, at rest - Authentication and access controls - Role-based permissions - Secure password practices - System monitoring - Audit logs - Security testing - Backup procedures - Incident monitoring - Administrative and technical safeguards - Periodic review of security controls Access to personal information is limited to authorized personnel, customers and service providers who require access for legitimate purposes. No electronic system can be guaranteed to be completely secure. Users are therefore encouraged to protect their passwords, authentication information and devices and to report suspected unauthorized access promptly. 7. ACCESS CONTROL AND CONFIDENTIALITY afriCore-OS applies access controls designed to ensure that users can access only the information necessary for their authorized responsibilities. For example, an administrator, accountant, loan officer, member, manager or other authorized user may receive different access privileges depending on their role. Organizations using afriCore-OS are responsible for properly assigning user roles and protecting their own administrator accounts and credentials. 8. SHARING AND DISCLOSURE OF INFORMATION We may disclose personal information where reasonably necessary and lawful. This may include disclosure to: Regulatory and Government Authorities Information may be disclosed where required by applicable law, regulation, court order or lawful governmental request. Depending on the relevant service, this may include regulatory or government authorities such as **SASRA, the Central Bank of Kenya, courts, law-enforcement agencies or other competent authorities**. Service Providers We may engage trusted service providers to support: - Cloud hosting - Payment processing - SMS and email communications - Analytics - Security - Identity verification - Technical support - Data backup - Infrastructure and system administration Where appropriate, contractual or other safeguards are used to require service providers to protect personal information and process it only for authorized purposes. Legal and Fraud-Prevention Purposes Information may be disclosed where reasonably necessary to: - Comply with legal obligations - Respond to court orders or lawful requests - Investigate suspected fraud - Protect users, customers or afriCore-OS - Establish, exercise or defend legal claims - Prevent misuse of our platform 9. INTERNATIONAL AND CROSS-BORDER DATA TRANSFERS Some service providers or technology infrastructure used by afriCore-OS may be located outside Kenya. Where personal information is transferred outside Kenya, afriCore-OS will seek to ensure that the transfer is carried out in accordance with applicable Kenyan data-protection requirements and appropriate safeguards. The Kenyan data-protection framework places requirements on transfers of personal data outside Kenya and requires appropriate safeguards or other lawful grounds where applicable. 10. DATA RETENTION We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law. Retention may be necessary to: - Provide contracted services - Maintain financial and transaction records - Meet legal and regulatory obligations - Support audits - Resolve disputes - Prevent fraud - Protect our legal rights - Maintain appropriate business records When personal information is no longer required, we will take reasonable steps to securely delete, destroy or anonymize it, subject to applicable legal and regulatory requirements. 11. YOUR DATA-PROTECTION RIGHTS Subject to applicable law and any lawful limitations, data subjects may have rights including: - The right to be informed about the processing of personal information - The right to access personal information - The right to request correction of inaccurate or misleading information - The right to object to certain processing - The right to request deletion or erasure where legally applicable - The right to restrict processing in circumstances provided by law - The right to data portability where applicable - The right to withdraw consent where processing is based on consent - The right to lodge a complaint concerning the processing of personal information The Office of the Data Protection Commissioner (ODPC) identifies these rights within Kenya's data-protection framework. Requests should be directed to: Email:info@africanmemsap.co.ke We may need to verify the identity of a person making a data request before providing access or making changes. 12. ACCOUNT AND DATA REQUESTS If your account is provided through a SACCO, cooperative, welfare organization or other institution, that organization may control certain personal information stored within its afriCore-OS account. In such cases, requests relating to membership records, financial records or other organization-controlled information may need to be directed to the relevant organization as the data controller. afriCore-OS will provide reasonable assistance to the relevant organization in accordance with applicable law and contractual obligations. 13. COOKIES AND SIMILAR TECHNOLOGIES afriCore-OS may use cookies and similar technologies to: - Maintain login sessions - Improve platform functionality - Remember user preferences - Improve performance - Understand usage patterns - Support security monitoring - Generate analytics Users may control cookies through their browser settings. Disabling certain cookies may affect the availability or functionality of some features. 14. COMMUNICATIONS We may communicate with users through: - Email - SMS - In-platform notifications - Telephone - Other authorized communication channels Communications may relate to: - Account activity - Transactions - Security alerts - Password or authentication events - Service interruptions - System updates - Important administrative notices Where communications are optional marketing or promotional messages, users may have the option to opt out where applicable. 15. CHILDREN'S PRIVACY afriCore-OS is primarily designed for SACCOs, cooperatives, welfare organizations and adults responsible for managing organizational services. We do not knowingly seek to collect children's personal information for independent use where such collection is not necessary or legally permitted. Where an organization legitimately processes information relating to children through afriCore-OS, the organization remains responsible for ensuring that the processing complies with applicable child-data protection requirements. Kenya's data-protection framework contains specific protections concerning children's data. 16. DATA BREACHES AND SECURITY INCIDENTS If afriCore-OS becomes aware of a personal-data security incident, we will take reasonable steps to: 1. Investigate and contain the incident; 2. Assess the nature and extent of the incident; 3. Implement appropriate remedial measures; 4. Preserve relevant evidence where appropriate; 5. Notify affected parties or competent authorities where required by applicable law; and 6. Take reasonable steps to prevent recurrence. The ODPC provides mechanisms for organizations to report data breaches and for data subjects to raise complaints concerning personal-data processing. 17. THIRD-PARTY LINKS AND SERVICES afriCore-OS may integrate with or provide access to third-party services. Third-party services may have their own privacy policies and terms of use. afriCore-OS is not responsible for privacy practices outside our control. Users should review the privacy terms of third-party services before providing information directly to those services. 18. ACCURACY OF INFORMATION We take reasonable steps to maintain accurate and up-to-date personal information. Users and organizations are encouraged to provide accurate information and notify the relevant administrator or afriCore-OS where information needs to be corrected. 19. USER RESPONSIBILITIES Users are responsible for: - Keeping passwords confidential - Protecting authentication credentials - Logging out of shared devices - Not sharing unauthorized access credentials - Reporting suspected security incidents - Providing accurate information - Using the platform in accordance with applicable laws and organizational policies Organizations using afriCore-OS are responsible for managing their authorized users and assigning appropriate system permissions. 20. CHANGES TO THIS PRIVACY POLICY We may update this Privacy Policy from time to time to reflect: - Changes in our services - Changes in technology - Changes in data-processing practices - Changes in applicable laws and regulations - Security or operational improvements When we make material changes, we may communicate them through the platform, website, email or other appropriate channels. The Last Updated date at the top of this policy will indicate when the policy was most recently revised. 21. COMPLAINTS AND DATA-PROTECTION CONCERNS If you have a concern about how afriCore-OS handles your personal information, please contact us first so that we can investigate and respond appropriately. afriCore-OS Email: info@africanmemsap.co.ke Privacy/Data Requests:support@africore-os.com Telephone: 0202318400 Website:africore-os.com Where a data subject believes that their concern has not been satisfactorily resolved, they may also have the right to seek assistance or lodge a complaint with the Office of the Data Protection Commissioner (ODPC)in accordance with applicable Kenyan law. afriCore-OS Email: info@africanmemsap.co.ke Privacy/Data Requests:support@africore-os.com Telephone: 0202318400 Website:africore-os.com 22. GOVERNING LAW This Privacy Policy shall be interpreted and applied in accordance with the laws of the Republic of Kenya, to the extent applicable. Nothing in this Privacy Policy limits any rights or protections that cannot lawfully be excluded under applicable data-protection or other legislation. 23. CONTACT US: If you have questions, requests or concerns about this Privacy Policy or the processing of your personal information, please contact: afriCore-OS Email: info@africanmemsap.co.ke Privacy/Data Requests:support@africore-os.com Telephone: 0202318400 Website:africore-os.com afriCore-OS:Protecting Your SACCO, Your Members, and Your Data.